Issue with IPSec VPN

Hey altafuom,

the issue is that the IPSec clients need to initiate the connection.

This means they need to be able to reach the FortiGate in question somehow via internet. If the FortiGate does not have a public IP, then I assume it is behind a router of some kind? You might have to set up port-forwarding or something like that on that router, so it knows to forward IPSec connection requests to the FortiGate.

In addition, if that internet-facing router changes public IPs, then you need DynDNS of some kind - that internet-facing router should be set up accordingly so it registers its own IP (and reports changes) to the DynDNS operator and the DNS name assigned to that internet-facing router always points to the correct IP.

That way, clients would connect to that hostname, resolve it via DNS and get your router's current public IP, the connection request hits the router, and the router should forward to FortiGate for further handling.

If the FortiGate itself is internet-facing (there's no router in between it and the internet) then you need to set up DynDNS on the FortiGate itself.

The clients need some way to reach the FortiGate via internet to successfully establish an IPSec VPN (or SSLVPN) tunnel.